CVE-2020-10195

Popup Builder <= 3.63 - Authenticated Settings Modification, Configuration Disclosure, and User Data Export

2020-03-12 00:00
Ram

Strategic Overview

Status
Patched in 3.64.1
Affected Plugin
Popup Builder – Create highly converting, mobile friendly marketing popups.
Affected Version
<= 3.63
CVSS
6.3Medium
Weakness type
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
CVE
CVE-2020-10195
View all Popup Builder – Create highly converting, mobile friendly marketing popups. vulnerabilities

At a glance

CVE-2020-10195 is a medium-severity Exposure of Sensitive Information to an Unauthorized Actor vulnerability in the Popup Builder WordPress plugin, affecting versions <= 3.63. It carries a CVSS score of 6.3 (reachable over the network; low attack complexity). Exploitation requires an authenticated account. The issue is fixed in version 3.64.1; sites on affected versions should update now. Disclosed March 2020, reported by Ram.

Vulnerability Overview

The Popup Builder plugin before 3.64.1 for WordPress allows information disclosure and settings modification, leading to in-scope privilege escalation via admin-post actions to com/classes/Actions.php. By sending a POST request to wp-admin/admin-post.php, an authenticated attacker with minimal (subscriber-level) permissions can modify the plugin's settings to allow arbitrary roles (including subscribers) access to plugin functionality by setting the action parameter to sgpbSaveSettings, export a list of current newsletter subscribers by setting the action parameter to csv_file, or obtain system configuration information including webserver configuration and a list of installed plugins by setting the action parameter to sgpb_system_info.

Technical Analysis

The vector marks this flaw as remotely reachable over the network, with low attack complexity — no special timing or configuration is needed, and no interaction from a victim user.

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

Reaching this weakness in Popup Builder <= 3.63 takes any authenticated account. Sensitive information exposure means data the application intended to keep internal is returned to a caller who should not be able to see it.

The disclosed data — credentials, tokens, customer records or internal paths — is usually worth more as material for a follow-up attack than as an end in itself. For Popup Builder the fix is 3.64.1: builds <= 3.63 are affected, anything from 3.64.1 onward is not.

Remediation

Update to version 3.64.1, or a newer patched version

How does WordSec protect against this?

The fix is the thing that ends this: Popup Builder 3.64.1 closes this, and updating the plugin is the step that ends it.

  • Alerts

External References

https://www.cve.org/CVERecord?id=CVE-2020-10195https://www.wordfence.com/threat-intel/vulnerabilities/id/a3a715b9-85df-46dd-9207-2066b6da9c43https://nvd.nist.gov/vuln/detail/CVE-2020-10195

Related records

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C